Skip to content

Commit afd82ea

Browse files
kral2kral2
committed
Add feature VCN Default Security List Lockdown
based on var.default_SL_lockdown: if true, delete all rules from VCN Default Security List if false, restore the original content of the Default Security List Issue: #22
1 parent 0c112cb commit afd82ea

File tree

10 files changed

+122
-40
lines changed

10 files changed

+122
-40
lines changed

‎CHANGELOG.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ The format is based on {uri-changelog}[Keep a Changelog].
99

1010
== unreleased
1111
* changed input region to be optional (fixes #18)
12+
* added a new parameter to lockdown the VCN Default Security List and option to revert to original state (fixes #22)
1213

1314
== v1.0.3 (July 13,2020)
1415

‎CONTRIBUTORS.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,4 @@ CONTRIBUTORS
99

1010
- @karthicgit
1111
- @difu
12+
- @kral2

‎README.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ Learn how to {uri-contribute}[contribute].
7777

7878
== License
7979

80-
Copyright © 2019 Oracle and/or its associates. All rights reserved.
80+
Copyright © 2019, 2021, Oracle and/or its associates.
8181

8282
Licensed under the {uri-license}[Universal Permissive License 1.0] as shown at
8383
{uri-canonical-license}[https://oss.oracle.com/licenses/upl].

‎README.md‎

Lines changed: 43 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,5 @@
11
# Terraform VCN for Oracle Cloud Infrastructure
22

3-
[changelog]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CHANGELOG.adoc
4-
[contributing]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTING.adoc
5-
[contributors]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTORS.adoc
6-
[docs]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/tree/master/docs
7-
8-
[license]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/LICENSE
9-
[canonical_license]: https://oss.oracle.com/licenses/upl/
10-
11-
[oci]: https://cloud.oracle.com/cloud-infrastructure
12-
[oci_documentation]: https://docs.cloud.oracle.com/iaas/Content/home.htm
13-
14-
[oracle]: https://www.oracle.com
15-
[prerequisites]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/prerequisites.adoc
16-
17-
[quickstart]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/quickstart.adoc
18-
[repo]: https://github.com/oracle/terraform-oci-vcn
19-
[reuse]: https://github.com/oracle/terraform-oci-vcn/examples/db
20-
[subnets]: https://erikberg.com/notes/networks.html
21-
[terraform]: https://www.terraform.io
22-
[terraform_cidr_subnet]: http://blog.itsjustcode.net/blog/2017/11/18/terraform-cidrsubnet-deconstructed/
23-
[terraform_hashircorp_examples]: https://github.com/hashicorp/terraform-guides/tree/master/infrastructure-as-code/terraform-0.12-examples
24-
[terraform_oci]: https://www.terraform.io/docs/providers/oci/index.html
25-
[terraform_options]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/terraformoptions.adoc
26-
[terraform_oci_examples]: https://github.com/terraform-providers/terraform-provider-oci/tree/master/examples
27-
[terraform_oci_oke]: https://github.com/oracle-terraform-modules/terraform-oci-oke
28-
293
The [Terraform VCN][repo] for [Oracle Cloud Infrastructure][OCI] provides a reusable [Terraform][terraform] module that provisions a minimal VCN on OCI.
304

315
It creates the following resources:
@@ -35,22 +9,26 @@ It creates the following resources:
359
* An optional NAT gateway
3610
* An optional service gateway
3711

38-
This module is primarily meant to be reusable to create more advanced infrastructure on {uri-oci}[OCI] either manually in the OCI Console or by extending the Terraform code.
12+
It also controls the Default Security List, with a *Lockdown mode* that can be enabled or disabled.
13+
14+
This module is primarily meant to be reusable to create more advanced infrastructure on [OCI][OCI] either manually in the OCI Console or by extending the Terraform code.
3915

4016
## [Documentation][docs]
4117

4218
### [Pre-requisites][prerequisites]
4319

4420
#### Instructions
45-
- [Quickstart][quickstart]
46-
- [Reusing as a Terraform module][reuse]
47-
- [Terraform Options][terraform_options]
21+
22+
* [Quickstart][quickstart]
23+
* [Reusing as a Terraform module][reuse]
24+
* [Terraform Options][terraform_options]
4825

4926
## Related Documentation, Blog
50-
- [Oracle Cloud Infrastructure Documentation][oci_documentation]
51-
- [Terraform OCI Provider Documentation][terraform_oci]
52-
- [Erik Berg on Networks, Subnets and CIDR][subnets]
53-
- [Lisa Hagemann on Terraform cidrsubnet Deconstructed][terraform_cidr_subnet]
27+
28+
* [Oracle Cloud Infrastructure Documentation][oci_documentation]
29+
* [Terraform OCI Provider Documentation][terraform_oci]
30+
* [Erik Berg on Networks, Subnets and CIDR][subnets]
31+
* [Lisa Hagemann on Terraform cidrsubnet Deconstructed][terraform_cidr_subnet]
5432

5533
## Projects using this module
5634

@@ -70,7 +48,35 @@ Learn how to [contribute][contributing].
7048

7149
## License
7250

73-
Copyright (c) 2019, 2020 Oracle and/or its associates. All rights reserved.
51+
Copyright (c) 2019, 2021 Oracle and/or its associates.
52+
53+
Licensed under the [Universal Permissive License 1.0][license] as shown at
54+
[https://oss.oracle.com/licenses/upl][canonical_license].
55+
56+
<!-- Links reference section -->
57+
[changelog]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CHANGELOG.adoc
58+
[contributing]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTING.adoc
59+
[contributors]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTORS.adoc
60+
[docs]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/tree/master/docs
61+
62+
[license]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/LICENSE
63+
[canonical_license]: https://oss.oracle.com/licenses/upl/
7464

75-
Licensed under the [Universal Permissive License 1.0][license] as shown at
76-
[https://oss.oracle.com/licenses/upl][canonical_license].
65+
[oci]: https://cloud.oracle.com/cloud-infrastructure
66+
[oci_documentation]: https://docs.cloud.oracle.com/iaas/Content/home.htm
67+
68+
[oracle]: https://www.oracle.com
69+
[prerequisites]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/prerequisites.adoc
70+
71+
[quickstart]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/quickstart.adoc
72+
[repo]: https://github.com/oracle/terraform-oci-vcn
73+
[reuse]: https://github.com/oracle/terraform-oci-vcn/examples/db
74+
[subnets]: https://erikberg.com/notes/networks.html
75+
[terraform]: https://www.terraform.io
76+
[terraform_cidr_subnet]: http://blog.itsjustcode.net/blog/2017/11/18/terraform-cidrsubnet-deconstructed/
77+
[terraform_hashircorp_examples]: https://github.com/hashicorp/terraform-guides/tree/master/infrastructure-as-code/terraform-0.12-examples
78+
[terraform_oci]: https://www.terraform.io/docs/providers/oci/index.html
79+
[terraform_options]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/terraformoptions.adoc
80+
[terraform_oci_examples]: https://github.com/terraform-providers/terraform-provider-oci/tree/master/examples
81+
[terraform_oci_oke]: https://github.com/oracle-terraform-modules/terraform-oci-oke
82+
<!-- Links reference section -->

‎default-resources.tf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Copyright (c) 2021 Oracle Corporation and/or affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
3+
4+
# VCN default Security List Lockdown
5+
// See Issue #22 for
6+
resource "oci_core_default_security_list" "lockdown" {
7+
// If variable is true, removes all rules from default security list
8+
count = var.default_SL_lockdown == true ? 1 : 0
9+
manage_default_resource_id = oci_core_vcn.vcn.default_security_list_id
10+
}
11+
12+
resource "oci_core_default_security_list" "restore_default" {
13+
// If variable is false, restore all default rules to default security list
14+
count = var.default_SL_lockdown == false ? 1 : 0
15+
manage_default_resource_id = oci_core_vcn.vcn.default_security_list_id
16+
17+
egress_security_rules {
18+
// allow all egress traffic
19+
destination = "0.0.0.0/0"
20+
protocol = "all"
21+
}
22+
23+
ingress_security_rules {
24+
// SSH for all
25+
protocol = "6"
26+
source = "0.0.0.0/0"
27+
tcp_options {
28+
min = 22
29+
max = 22
30+
}
31+
}
32+
33+
ingress_security_rules {
34+
// ICMP for all type 3 code 4
35+
protocol = "1"
36+
source = "0.0.0.0/0"
37+
38+
icmp_options {
39+
type = "3"
40+
code = "4"
41+
}
42+
}
43+
44+
ingress_security_rules {
45+
//ICMP for VCN
46+
protocol = "1"
47+
source = var.vcn_cidr
48+
49+
icmp_options {
50+
type = "3"
51+
}
52+
}
53+
}

‎examples/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ module "vcn" {
7878
vcn_cidr = var.vcn_cidr
7979
vcn_dns_label = var.vcn_dns_label
8080
vcn_name = var.vcn_name
81+
default_SL_lockdown = var.default_SL_lockdown
8182
}
8283
```
8384

‎examples/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ module "vcn" {
2525

2626
vcn_name = "vcn"
2727

28+
default_SL_lockdown = "true"
29+
2830
tags = {
2931
environment = "dev"
3032
lob = "finance"

‎examples/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,3 +82,9 @@ variable "vcn_name" {
8282
description = "user-friendly name of to use for the vcn to be appended to the label_prefix"
8383
type = string
8484
}
85+
86+
variable "default_SL_lockdown" {
87+
description = "whether to remove all default security rules from the VCN Default Security List"
88+
default = true
89+
type = bool
90+
}

‎schema.yaml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ groupings:
99
- vcn_cidr
1010
- vcn_name
1111
- vcn_dns_label
12-
13-
12+
- default_SL_lockdown
13+
1414
variables:
1515
region:
1616
type: oci:identity:region:name
@@ -49,6 +49,12 @@ variables:
4949
required: true
5050
default: vcn
5151

52+
default_SL_lockdown:
53+
title: Enable VCN Default Security List Lockdown
54+
type: string
55+
required: false
56+
default: true
57+
5258
tags:
5359
type: map
5460
visible: false

‎variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,3 +65,9 @@ variable "vcn_name" {
6565
description = "user-friendly name of to use for the vcn to be appended to the label_prefix"
6666
type = string
6767
}
68+
69+
variable "default_SL_lockdown" {
70+
description = "whether to remove all default security rules from the VCN Default Security List"
71+
default = true
72+
type = bool
73+
}

0 commit comments

Comments
 (0)